PT-2024-1069 · Tp Link · Tp-Link Archer Ax5400+2

Chuya Hayakawa

·

Published

2024-01-10

·

Updated

2024-07-03

·

CVE-2024-21821

CVSS v2.0

8.3

High

VectorAV:N/AC:L/Au:M/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions TP-Link Archer AX3000 versions TP-Link Archer AX5400 versions TP-Link Archer AXE75 versions
Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands.
Recommendations For TP-Link Archer AX3000, consider restricting access to the LAN port and Wi-Fi to minimize the risk of exploitation until a patch is available. For TP-Link Archer AX5400, restrict access to the LAN port and Wi-Fi to minimize the risk of exploitation until a patch is available. For TP-Link Archer AXE75, restrict access to the LAN port and Wi-Fi to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-00306
CVE-2024-21821

Affected Products

Tp-Link Archer Ax3000
Tp-Link Archer Ax5400
Tp-Link Archer Axe75